Software Updates

correct the applied time on the ProductView trigger drop

• It ran at ~15:23 -03, not 11:40; the last trigger error in the logs is
• 15:22:16.

file the ProductView trigger drop as applied

• Run against production 2026-10-02 from the Supabase SQL editor at the
• owner's request; triggers_left = 0, functions_left = 0.

read the Marketplace Upstash store's KV_REST_API_* names

• Upstash for Redis was provisioned through the Vercel Marketplace today
• (store katura-ratelimit, production + preview). The Marketplace injects
• KV_REST_API_URL / KV_REST_API_TOKEN, while the limiter only read
• UPSTASH_REDIS_REST_*, so it would have kept falling back to per-instance
• memory limits. The limiter and the boot warning now accept either name.
• The response cache and job-queue cron still read only UPSTASH_*, so this
• turns on distributed rate limiting and nothing else. Verified the store
• answers the limiter's exact calls (pipeline INCR/EXPIRE, TTL).

write drafts with Claude Haiku 4.5 instead of gpt-4o

• The daily blog-agent cron had been failing since the OpenAI account ran out
• of credits (429 credit_balance_exhausted). Drafts now go through the
• Anthropic SDK with claude-haiku-4-5, using ANTHROPIC_API_KEY (already set
• in production). output_config.format enforces the draft JSON schema, so the
• reply always parses; refusal and max_tokens stops are reported instead of
• surfacing as a JSON parse error. ?model= still overrides per run.
• Also gives the cron its own 300 s maxDuration: the cron/** glob capped it
• at 30 s, below the route's own 120 s, too short for two essays plus the
• length and SEO retries.

share the real KATURA card instead of the generated navy image

• Delete the eight generated images
• Add DEFAULT_OG_IMAGES (public/brand/katura-og.png: WLM monogram, KATURA, EST 1999) to the 42 storefront pages whose own openGraph block had no image. Next replaces the parent openGraph wholesale, so pages like /blog, /contact and /creations/earrings shared with no image at all.

quiet expected warnings and drop the health-ping cron

• ExchangeRates: one info line per fetch listing fallback currencies, instead of 22 warnings per storefront call (Frankfurter only covers ~30)
• WebVitals: log the real CLS score (the reporter sends it x1000)
• JobQueue cron: skipping without Upstash is info, not a warning; nothing enqueues into this queue today
• Remove the /api/health?ping=true cron the route itself flags as waste

drop the Host directive from robots.txt

• Google ignores Host (a Yandex extension) and Search Console flags it as an
• unrecognised rule.

collection JSON-LD lists URLs instead of Product offers

• generateCollectionSchema nested up to 10 Product + Offer items with a
• hardcoded InStock and the raw DB price (no sale price, no price-on-request,
• no sold-out), which Merchant listings validated and flagged. mainEntity is now
• an ItemList of ListItem URLs, the same shape as generateItemListSchema. Each
• PDP still carries the authoritative Product/Offer.
• Also drop VideoObject.embedUrl when no slug is given rather than
• interpolating it into /creations/null.

308 /shop/:id in the proxy and noindex the rosser host

• /shop/:id (with or without a locale prefix) now gets one 308 to
• /creations/:id from the proxy, replacing 200 -> client redirect to
• /en/creations/:id -> 307. It lives in the proxy rather than next.config
• because config redirects count toward Vercel's 2048-route cap.
• rosser.katura1999.com has no host rewrite, so every path on it serves the
• KATURA storefront and it was taking ~27% of Googlebot's crawl. The ROSSER
• storefront itself (/rosser/*) is already noindex, nofollow. Responses on that
• host now carry X-Robots-Tag: noindex. Nothing changes for visitors.

return real 404s and permanent redirects instead of soft 404s

• [locale]/loading.tsx (plus the creations and collections loading files)
• wrapped every storefront page in a Suspense boundary, so the 200 shell was
• flushed before notFound() or permanentRedirect() ran. Missing and inactive
• products and collections answered 200 + noindex, and /shop/[id] answered 200
• with a client-side redirect. Removing those boundaries lets the status code
• reflect the page.
• The not-found pages now declare robots noindex themselves. Error-convention
• metadata merges last, so it replaces the root layout's "index, follow" and
• googlebot hints that were rendered next to Next's noindex tag.
• /shop/[id] and /[locale]/products/[slug] fall back to a locale-less
• permanentRedirect (localePrefix is 'never', so /en/ cost a second hop).

serve blocking head metadata to Googlebot and major crawlers

• Next 16 streams title/canonical/robots into the body for any UA outside its
• HTML-limited bot list, and that list omits the main Googlebot. Googlebot got
• the canonical ~340 KB in, after </head>, and URL Inspection reported
• "User-declared canonical: None". htmlLimitedBots now extends Next's default
• list with Googlebot, GoogleOther and other search/AI crawlers.

stage the ProductView stale-trigger drop for the owner

• update_product_view_updated_at_trigger sets NEW.updated_at, a column the
• Feb 2026 schema sync dropped, so every UPDATE on ProductView fails
• (P2022 column `new`) and POST /api/products/[id]/view 500s ~380x/day.
• Dropping a trigger is not additive, so it is staged in pending/ rather
• than applied.

keep expected rejections out of the error log; let synthetic tests finish

• rate-limit: the missing-Upstash notice was console.error on every rate-limited request (~100/day); now one warn per instance.
• register / reset-password / custom-ring-order: a ZodError is a 400, so it is no longer logged at error level before the 400 is returned.
• brevo / shipstation webhooks: unsigned POSTs (only the synthetic probe sends them) log at warn.
• synthetic-tests cron: the cron/** glob capped it at 30s, so every run 504'd before persisting results or sending alerts. Give it 300s.

stop querying tables the Feb 2026 schema sync dropped

• health-check cron: no longer persists results (insert, history, uptime and alert-dedupe queries all failed; the dedupe already failed open).
• GET /api/bundles: a missing table reads as "no bundles" without an error log; writes still fail loudly.
• daily-all cron: inventory-velocity retired from the job.

answer unauthenticated callers with 401/403, not a 500

• All 77 /api/platform/* (and saas/tenant/usage) handlers called
• getPlatformAdminContext(), the page guard, which calls redirect(). Inside
• the handlers' try/catch the NEXT_REDIRECT control-flow error was caught,
• logged at error level and returned as 500 { error: "NEXT_REDIRECT" }.
• The guard now resolves once (resolvePlatformAdminContext) and has two
• front ends: getPlatformAdminContext() still redirects for pages, and
• getPlatformApiContext() throws PlatformApiAuthError, which each handler's
• catch turns into 401 (no session) or 403 (no tenant / platform operator /
• blocked tenant). Handlers without a try use
• getPlatformApiContextOrResponse().
• The synthetic probes for these routes accepted 500 as a pass; they now
• expect 200/401/403 so a real 500 fails the run.

add the EngagementLead attribution columns prod never got

• engagement.prisma declared offerVariant, landingPageVariant, the utm_*,
• metaFb* and smartLinkClickId columns on EngagementLead in May/June, but
• only Consultation was ever altered. Every full-row EngagementLead read
• failed with P2022 "EngagementLead.offerVariant does not exist", which
• 500'd POST /api/newsletter.
• Purely additive (nullable TEXT, IF NOT EXISTS). Applied to production
• 2026-10-01 and recorded in _prisma_migrations (applied_steps_count 0);
• newsletter POST verified 200 afterwards.

stop the auditor failing decks for the engine's own words

• "I wrote out the exact rewrite" — the writer rules tell him to offer the written-up fix, and the ledger audited it as a prospect fact (Ruback, Aspen Hive, The Vault, Stark). It is sender context: the free-value gate guarantees the copy-ready asset exists before the audit runs. The classifier recognises it (still refusing anything about "you/your"), and founderStatement now approves it, in the same commit.
• Brief lines were ledgered with no citations, so the auditor could only answer UNSUPPORTED (Lovette, Ruback, Tuel). They now carry the deck's evidence, as the email restatements have since 2026-08-25.
• Snapshot tiles that only report the limits of our evidence ("we did not identify verified … evidence in the materials provided") become unassessed tiles instead of absence claims (Zimmerman). A dated ad-library absence is left alone.

this exact ring $10,000, projects from $7,000

• Hero, pricing cards, FAQ, sticky bar and metadata carry the new numbers in all 24 locales; the lab-grown disclosure now also sits next to the "from $7,000" price.
• The custom card explains where the lower price comes from, and the metal option lists 14K as well as 18K.
• New "$7,000–$10,000 custom" budget chip; the exact-ring chip is now "$10,000 — this exact ring".

show the original ring worn in the on-hand video

• "See 7.77 carats on a hand" now plays the finished ring on the hand of
• the woman who received it, in place of the loose stone. The clip is a
• 464×832 H.264 MP4 at 0.7 MB (the old .mov was 6.7 MB) with a poster
• frame, and the caption reads "The original 7.77 carat ring, worn." in
• all 24 locales. The loose-stone clip stays for the generic offer page.

list plainEnglish in the writer's JSON shape

• The prose has asked for a "plainEnglish" sentence on every finding since
• 2026-08-25, but the JSON shape the writer copies never listed the field,
• and the schema requires it. After the 2026-09-27 rule rewrite lengthened
• the prompt, the model dropped it on most runs: 14 of 18 rebuilds threw
• "Writer output failed schema validation" and saved no deck or email.
• The pipeline swallowed that error, so the console showed a 200 with
• nothing written. It now logs the error and returns it as generationError.
• A test pins every schema-required finding field into the writer's shape.

show the 7.77 CT engraving close-up in the story section

name no one on the 7.77 page

• The owner asked not to be named. The story becomes "designed for a real
• proposal" in all 24 locales, the family quote is removed (without its
• speaker's relationship it would read as a customer review), and the ring
• images move to neutral filenames so no name appears in the page source or
• share card.

prospecting engine unblocked — send path, compliance, evidence-backed emails, console redesign

• Four parallel fixes integrated after the 2026-09-26 audit found the engine
• had sent nothing since 2026-08-26: slug/token offer links, needs-rewrite and
• parked-for-review states, clamped schedules and a 10/day ramp, one
• suppression model with reply opt-outs and one-click unsubscribe, US-only
• jurisdiction gate, owner/manager write guards, evidence-only numbers and
• problem claims, owner extraction from About pages, and a redesigned console.

send gate header matches the suppression rules

pin the parked-for-review invariants

• triageQueue skips a 'Parked for review:' row (never planned, never re-stamped with a needs-rewrite note, counted as parkedForReview).
• The cron never plans or auto-approves one, and a gate refusal at its slot keeps the parked note (only the slot is cleared).
• The approve route validates with firstTouchOptionsFor for the stored body and clears the parked note only when every check passes.

the console judges by the send path's rules, and respects roles

• console-health-rules classifyQueueEmail uses send-readiness.ts (needsRewriteReason / isDeckExpired / NEEDS_REWRITE_MARKER) instead of re-implementing resolveEmailAttachment: with attachments off a withheld deck is simply not attached (ready), only a body promising one is blocked.
• Buckets: 'Needs rewrite — copy mentions an attachment' (Rewrite action) and 'Needs rewrite — deck expired' (Rebuild action: a rewrite alone cannot clear an expired deck). attachment_off is gone.
• Jurisdiction via jurisdictionVerdict (CASL, PECR, unknown state, .ca/.uk sites): one 'Outside the US' bucket; canada key renamed jurisdiction.
• offer_link keeps its bucket for genuine mismatches, without the stale 'needs the send-path fix' hint; its fix is now Rewrite.
• console-health selects bodyText + website; REFUSAL/NEEDS_REWRITE/PARKED markers re-exported from send-readiness (no duplicate constant).
• 'Parked for review:' drafts go to Needs you (before the deck checks — the generator fails the fact-check on purpose) with their failure reasons; the detail card explains them and offers Approve even under auto-approve.
• Rewrite results say 'N parked for review' (fallback is gone).
• Attachment badge: PROPOSAL PDF ATTACHED only when the policy names it and attachments are on; otherwise NO ATTACHMENT (no red 'expected' badge).
• Arm C shown as frozen; Settings show single-arm mode (EXPERIMENT_MODE / SINGLE_ARM) — the page passes them.
• Prospect-level review counts are hidden unless a verified evidence row backs them (list rows, full record); the manual reviews input is labelled operator-entered; hand-added evidence says it is operator-attested.
• Client lead score passes icpExclusion (console + deal page), so 'Outside the ICP — …' matches the planner. The Autopilot UK note no longer says PECR permits cold email.
• page.tsx (and the deal and diagnosis pages) pass canWrite from the session role (admin-guard PROSPECTING_WRITE_ROLES); _components/role.tsx provides it. For EMPLOYEE every write control is hidden or disabled — blocked-panel fixes, bulk research/rewrite, row Test/Approve/Send now, detail Edit/Approve/Send/Rebuild/Advanced, search/add/start Autopilot, payment test, Standard fixes, deal stage/fields/notes/mail, diagnosis run and guidance — with a one-line 'Owner or manager only' note. Stop Autopilot stays available to everyone.

wire the prompt-layer branch into the send path

• send.ts validates first touches with firstTouchOptionsFor (evidence, recipient country, business name, offer link). The offer URL has one source of truth, offer-link.ts: a stored body is checked against whichever of the order's two permanent links (slug or legacy token) it carries; a new draft gets slug ?? token. Same for the approve route.
• Parked for review ('Parked for review:' errorDetail): never planned (loadCandidates SQL + triageQueue), never re-stamped by a needs-rewrite or refusal note (send gate, cron), excluded from follow-up re-spread; a validated manual approval clears it. isParkedForReview in send-readiness.
• Planner scoreLead gets icpExclusion; an ICP-excluded lead (tier D) ranks after every in-ICP lead.
• Standard route grades with the same evidence rows, recipient country and business name (FIRST_TOUCH_EVIDENCE_SELECT/WHERE shared with variant.ts).
• rewrite-all counts 'parked' instead of the retired 'fallback'.
• PATCH add-evidence stamps manual rows MANUAL_CAPTURE / ADMIN_ATTESTATION / VERIFIED (+ verifiedAt/By) so an owner-entered rating can be quoted.
• The prospects list carries reviewsVerified (a verified review metric backs the prospect-level figure) so the console can hide placeholders.
• Follow-ups: followUpClaimFailures applies the first touch's evidence rule, no-price-comparison rule (priceComparisonFailure, exported rather than copied) and no-attachment rule, at drafting and again at the send gate; the writer is told truthfully whether the first touch carried a deck.
• /pitch/r/[token] no longer shows the $1,250 'once we stop taking on new stores' anchor (anchorCents stays in the table).

count the 7.77 design request as the Lead, a later booking as Schedule

• Lead form success fires the Meta Lead (pixel, fresh ld_ id) and GA4 setUserProvidedData + generate_lead (lead_source / consultation_type / offer). /api/consultation/availability-request accepts that id as metaEventId and sends the Conversions API Lead twin in after(): the typed email / phone and the name split into fn / ln, content_name "Private consultation request"; only with a valid ld_ id; staff sessions, internal emails and the katura_internal cookie send nothing — same rules as /api/consultation.
• A time booked afterwards in "Choose a time" is not a second Lead: it sends an sc_ id, the pixel fires the standard Schedule event, /api/consultation sends trackCapiSchedule under the same id, and GA4 gets book_consultation instead of generate_lead. A booking with no earlier Lead on the page (and every other offer page, and the evergreen page) still sends ld_ and fires Lead + generate_lead exactly as before.
• tracking-request: new 'schedule' kind, sc_ prefix only (ld_ and sc_ are never interchangeable). meta-capi: 'Schedule' event name; trackCapiLead and trackCapiSchedule share one sender. Content names live in src/lib/tracking/consultation-conversions.ts for browser and server.
• All 777_* and consultation_* funnel events unchanged.

rebuild the 7.77 landing page for paid social traffic

• First screen at 390x844: "The 7.77 — designed for our own proposal", the ring, "This ring $9,000 · lab-grown 7.77 ct" / "Fully custom from $10,000", one "Design yours" CTA; press logos become a thin strip under it.
• Sections: story, make it yours, two price cards (+ the lab-grown martini studs bonus, financing/shipping/sizer, final-sale line), how it works, Zack's quote with the family relationship disclosed (no stars), press line, on-hand video that only loads on tap, 6-question FAQ, then the form.
• One action: lead-first form (name, email, optional phone, budget chips, optional shape) → optional booking step, pre-filled. Booking goes through the new shared submitConsultationBooking(), so GA4 generate_lead and the Meta Lead deduplicated via metaEventId stay identical on every offer.
• Mobile sticky "Design yours · from $9,000" bar: shows once the hero CTA is gone, hides over the form, at the footer and while a field has focus; respects the safe area and stamps html[data-sticky-buy-bar] so the floating WhatsApp button steps aside (in-flow link rendered instead).
• 777-b keeps its split layout: form right under the hero on phones, sticky left column on desktop.
• Removed: every scarcity/inventory claim, "Most popular", the "first 7.77 ring" world-first claim, the fake five-star "verified client" card, the 7.77 stone-alert popup (deleted), the $100 exit-intent popup, the Love Stories carousel and wedding-site upsell on this page. The calendar's always-on "Almost Fully Booked — call first" days are off here via a new nearTermDays="bookable" option (default unchanged for other pages).
• Metadata: new title/description/OG (square ring image), still noindex.
• engagement.offer777 rewritten in en and translated into all 23 other locales; old keys removed.

keep the budget on 777 availability requests

• The 7.77 lead form has always sent budgetRange, but the availability-request
• schema did not declare it, so zod stripped it and the concierge never saw
• the budget the visitor picked. Accept it (and cap the free-text lengths),
• write it into the EngagementLead note and the concierge email, and escape
• visitor-typed values in that email.

Merge branch 'worktree-agent-ac76de272253cc48a' (prospecting prompt layers)

record human offer-page views, not just the scanner's first hit

• The offer page wrote OFFER_PAGE_VIEWED on the first view only, and that was
• almost always a mail scanner 1-3 minutes after delivery, so the hot-leads
• rule (a view >= 10 min after delivery) never saw a person. offer-view.ts
• now records the first view (funnel count) plus any view at least
• SCANNER_WINDOW_MINUTES after the latest live delivery, deduped against
• post-window views in the last 30 minutes — a scanner's early event never
• suppresses a later human one.

log every stage change as a STATUS_CHANGE event

• PATCH prospects/[id] with a new status now writes a ProspectingEvent
• (type STATUS_CHANGE, source admin, metadata {from, to, actor}) in the same
• transaction as the update. The deal page's Stage select could set
• SUPPRESSED / WON / LOST with no trace on the timeline.

follow-up timing defined once, in schedule.ts

• schedule.followUpNotBefore (cadence day + the gap after the previous touch
• actually sent) clamped by spreadFollowUps is the one definition. The
• compliance branch's followUpSendNotBefore — a second clamp-to-now that
• nothing called — is removed, and followUpDueDate now delegates to
• followUpNotBefore. Tests pin the equivalence and the future placement.